In Re FACEBOOK INTERNET TRACKING LITIGATION

Filing 179

NOTICE OF APPEAL to the 9th Circuit Court of Appeals filed by Perrin Aikens Davis, Brian K. Lentz, Cynthia D. Quinn, Matthew J. Vickery. Appeal of Order #175 , Order on Motion to Dismiss, Order on Motion for Protective Order, Order on Motion to Compel #148 , Order on Motion to Dismiss, #87 , Order on Motion to Dismiss #174 (Appeal fee of $505 receipt number 0971-11952369 paid.) (Attachments: #1 Exhibit A, #2 Exhibit B, #3 Exhibit C, #4 Exhibit D, #5 Representation Statement)(Straite, David) (Filed on 12/14/2017)

Exhibit C

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 1 of 9

1
2
3
4
5
6
7
8

UNITED STATES DISTRICT COURT

9

NORTHERN DISTRICT OF CALIFORNIA

10

SAN JOSE DIVISION

United States District Court
Northern District of California

11
In re Facebook Internet Tracking Litigation

12
13

Case No. 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S
MOTION TO DISMISS

14

Re: Dkt. No. 162
15
16
17
Plaintiffs’ third amended complaint alleges that Defendant Facebook, Inc. violated its

18
19

contractual obligations by tracking logged-out Facebook users on third-party websites. Facebook

20

now moves to dismiss for the third time. Facebook’s motion will be granted.

21

I.

BACKGROUND
In this putative class action, Plaintiffs allege that Facebook improperly tracked the web

22
23

browsing activity of logged-out Facebook users on third-party websites.1 Third Am. Compl.

24

(“TAC”), Dkt. No. 157. Plaintiffs previously asserted a variety of common law claims and claims

25
26
27
28

1

For a more detailed discussion of Plaintiffs’ factual allegations, see this Court’s orders granting
Facebook’s motion to dismiss Plaintiffs’ first amended complaint (Dkt. No. 87 at 2–6) and
Facebook’s motion to dismiss Plaintiffs’ second amended complaint (Dkt. No. 148 at 1–3).
Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
1

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 2 of 9

1

for violations of federal and state statutes. After two rounds of motions to dismiss, this Court

2

dismissed the majority of Plaintiffs’ claims with prejudice for lack of standing and for failure to

3

state a claim. Order Granting Def.’s Mot. to Dismiss (“MTD Order”), Dkt. No. 148. This Court

4

granted leave to amend only as to Plaintiffs’ claims for breach of contract and breach of the duty

5

of good faith and fair dealing. Id. Plaintiffs timely filed their third amended complaint. Facebook

6

now moves to dismiss under Fed. R. Civ. P. 12(b)(6) and 15(c). Def.’s Mot. to Dismiss (“MTD”),

7

Dkt. No. 162.

8

II.

LEGAL STANDARD
A motion to dismiss under Fed. R. Civ. P. 12(b)(6) tests the legal sufficiency of claims

9

alleged in the complaint. Parks Sch. of Bus., Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir.

11
United States District Court
Northern District of California

10

1995). Dismissal “is proper only where there is no cognizable legal theory or an absence of

12

sufficient facts alleged to support a cognizable legal theory.” Navarro v. Block, 250 F.3d 729, 732

13

(9th Cir. 2001). The complaint “must contain sufficient factual matter, accepted as true, to ‘state a

14

claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting

15

Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

16

III.

17

DISCUSSION
Plaintiffs’ TAC asserts causes of action for (1) breach of contract (TAC ¶¶ 139–48) and (2)

18

breach of the duty of good faith and fair dealing (TAC ¶¶ 149–61). Plaintiffs also seek to enlarge

19

the scope of the proposed class.

20

A.

21

Plaintiffs allege that each of them entered into a contract with Facebook that consisted of

Breach of Contract

22

(1) Facebook’s Statement of Rights and Responsibilities (“SRR”), (2) Facebook’s Privacy Policy,

23

and (3) relevant pages from Facebook’s Help Center. TAC ¶ 140. According to Plaintiffs,

24

Facebook promised in the contract that it would not track the web browsing activity of logged-out

25

Facebook users on third-party websites. Id. ¶ 142. Plaintiffs allege that Facebook broke that

26

promise by collecting data about logged-out users’ browsing activity and using cookies to connect

27
28

Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
2

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 3 of 9

1

that activity to users’ identities. Id.
To state a claim for breach of contract, Plaintiffs must allege that (1) they entered into a

2
3

contract with Facebook, (2) Plaintiffs performed or were excused from performance under the

4

contract, (3) Facebook breached the contract, and (4) Plaintiffs suffered damages from the breach.

5

Oasis W. Realty, LLC. v. Goldman, 51 Cal. 4th 811, 821 (2011) (citing Reichert v. General Ins.

6

Co., 68 Cal. 2d 822, 830 (1968)). “In an action for breach of a written contract, a plaintiff must

7

allege the specific provisions in the contract creating the obligation the defendant is said to have

8

breached.” Woods v. Google Inc., No. 05:11-cv-1263-JF, 2011 WL 3501403, at *3 (N.D. Cal.

9

Aug. 10, 2011).
The parties agree that the SRR constitutes a contract. MTD 8; Pls.’ Opp’n to Def.’s Mot. to

11
United States District Court
Northern District of California

10

Dismiss (“Opp’n”), Dkt. No. 163. However, the SRR itself does not contain a promise to not track

12

logged-out users. Rather, Plaintiffs argue that the operative contract is a combination of provisions

13

from Facebook’s SRR, Facebook’s Privacy Policy,2 and Facebook’s Help Center pages.3

14

i.

15

The Data Use Policy was not incorporated by reference into the Statement of
Rights and Responsibilities.

Plaintiffs cite the following language from Facebook’s Data Use Policy (dated September

16
7, 2011):
17

19

We receive data whenever you visit a . . . site with a Facebook
feature (such as a social plugin). This may include the date and time
you visit the site; the web address, or URL, you’re on; technical
information about the IP address, browser and the operating system
you use; and, if you are logged in to Facebook, your User ID.

20

TAC ¶ 60 (emphasis added). Plaintiffs argue that this language “implicitly promises to the average

21

user that Facebook will not receive [a user-identifying] cookie when the user is not logged in.” Id.

18

22
23
24
25
26
27
28

2

During the alleged class period, Facebook changed the title of this document from “Privacy
Policy” to “Data Use Policy.” Opp’n 4 n.4. As discussed below, Facebook also changed the
substance of the document. In this order, unless otherwise indicated, the term “Privacy Policy”
refers to both the Privacy Policy and the Data Use Policy.
3
Plaintiffs’ statement of their cause of action for breach of contract does not identify the specific
contractual language that Facebook allegedly breached. TAC ¶¶ 139–48. However, Plaintiffs
identify specific contractual language in their brief in opposition to Facebook’s motion to dismiss.
Opp’n 4 (citing factual allegations in the TAC at ¶¶ 24, 57, 60, and 62–67).
Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
3

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 4 of 9

1

Plaintiffs argue that this version of the Data Use Policy is part of the contract because it

2

was incorporated by reference into the SRR. Opp’n 4–5. Under California law, for the terms of

3

another document to be incorporated by reference into an executed document, “the reference must

4

be (1) clear and unequivocal, the (2) reference must be called to the attention of the other party

5

and he must consent thereto, and (3) the terms of the incorporated document must be known or

6

easily available to the contracting parties.” Woods, 2011 WL 3501403, at *3 (quoting Troyk v.

7

Farmers Grp., Inc., 171 Cal. App. 4th 1305, 1331 (2009)).
Here, Plaintiffs argue that the Privacy Policy was incorporated by reference into the SRR

8
9

because of the following language in the SRR:

10

Your privacy is very important to us. We designed our Privacy
Policy to make important disclosures about how you can use
Facebook to share with others and how we collect and can use your
content and information. We encourage you to read the Privacy
Policy, and to use it to help make informed decisions.

United States District Court
Northern District of California

11
12
13

TAC ¶¶ 24, 57.4 According to Plaintiffs, this language means that the Privacy Policy is

14

incorporated by reference into the SRR because the “SRR expressly refers to the Privacy Policy,

15

says that the Policy is important, links to that Policy and tells users to read it to make important

16

decisions about their privacy.” Opp’n 5.

17

Plaintiffs’ complaint cites four versions of Facebook’s SRR, dated April 22, 2010 (TAC

18

Ex. A), August 25, 2010 (TAC Ex. B), October 4, 2010 (TAC Ex. C), and April 26, 2011 (TAC

19

Ex. D). TAC ¶¶ 19–20. The excerpt quoted above appears in all four versions of the SRR.
As discussed above, Plaintiffs argue that Facebook’s Data Use Policy promised that

20
21

Facebook would not track logged-out users. However, the version of the Data Use Policy that

22

contains this language was not published until September 7, 2011—more than four months after

23

the latest version of the SRR (dated April 26, 2011) that Plaintiffs attach to their complaint. See

24

TAC Ex. D (attaching the April 26, 2011, version of the SRR), Ex. H (attaching the September 7,

25
26
27
28

4

Plaintiffs’ opposition brief quotes additional language from the SRR that is not cited in the TAC:
“You may also want to review the following documents: Privacy Policy: the Privacy Policy is
designed to help you understand how we collect and use information.” Opp’n 5.
Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
4

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 5 of 9

1

2011, version of the Data Use Policy). Earlier versions of the Privacy Policy did not contain the

2

language that Plaintiffs allege constitutes a promise not to track logged-out users. Compare id. Ex.

3

H (attaching the September 7, 2011, version of the Data Use Policy, which states that Facebook

4

“receive[s] data whenever you visit a . . . site with a Facebook feature (such as a social plugin) . . .

5

. [including], if you are logged in to Facebook, your User ID”) (emphasis added), with id. Ex. E

6

(attaching the April 22, 2010, version of the Privacy Policy), Ex. F (attaching the October 5, 2010,

7

version of the Privacy Policy), and Ex. G (attaching the December 22, 2010, version of the

8

Privacy Policy).
As Facebook points out, the SRR does not use the term “Data Use Policy” and does not

9

contain any other references to the Data Use Policy. MTD 11–12. Nor could it, since the Data Use

11
United States District Court
Northern District of California

10

Policy Plaintiffs cite and rely on did not exist until several months after Facebook published the

12

most recent version of its SRR that Plaintiffs attach to their complaint. Plaintiffs do not address

13

this deficiency in their opposition brief. Compare MTD 11–12 (noting that the Data Use Policy

14

“was active starting on September 7, 2011,” and that the policy “was not incorporated into any of

15

the SRR versions attached to the TAC, and was therefore not a part of the contract”), with Opp’n

16

4–5 (arguing that the SRR “expressly refers to the Privacy Policy,” but offering no response to

17

Facebook’s point that the Data Use Policy was not operative at the time the cited SRR was

18

published). In addition, Plaintiffs do not allege that earlier versions of the Privacy Policy

19

contained similar promises to not track logged-out users.5
As such, the Court finds that the Data Use Policy was not incorporated by reference into

20
21
22
23
24
25
26
27
28

5

During the hearing on Facebook’s motion on November 16, 2017, Plaintiffs’ counsel argued that
the September 7, 2011, Data Use Policy is incorporated into the April 26, 2011, SRR because
Facebook’s users continuously agree to the SRR each time they use or access Facebook. Plaintiffs
base this argument on the following statement from the SRR: “By using or accessing Facebook,
you agree to this Statement.” TAC Ex. D. Under this theory, Plaintiffs argue that they agreed to
the SRR on or after September 7, 2011, which means that the Data Use Policy would have been
incorporated into the contract between the parties as of that date. This argument fails for two
reasons: first, the TAC does not identify the dates that Plaintiffs “used or accessed” Facebook; and
second, Plaintiffs have not alleged that the April 26, 2011, version of the SRR remained in effect
as of September 7, 2011.
Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
5

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 6 of 9

1

the SRR because the SRR did not “clearly and unequivocally” reference it. See Troyk, 171 Cal.

2

App. 4th at 1331.

3
4

ii.

The relevant Help Center pages were not incorporated by reference into the
Statement of Rights and Responsibilities.

Plaintiffs also argue that various Help Center pages were incorporated by reference into the
5
6
7

SRR. Opp’n 5–8. Facebook notes, and Plaintiffs do not dispute, that the SRR contains no direct
references to any Help Center pages. See MTD 8–9 (“the SRR does not reference—or even hint
at—a single one of the Help Center pages Plaintiffs quote from”); Opp’n 6 (“the Help Center

8
pages are the third link in the contractual chain . . . . the Privacy Policy linked to the Help Center
9

pages and directed users to them”). Rather, Plaintiffs’ theory is that certain Help Center pages

10
were incorporated by reference into the Privacy Policy, and that the Privacy Policy was in turn

United States District Court
Northern District of California

11
12
13
14
15

incorporated into the SRR. Opp’n 7 (“the SRR incorporates the Privacy Policy, and, in turn, the
Help Center pages”); TAC ¶¶ 61 (“The Help Center pages are incorporated by reference into the
Privacy Policy and are a part of the contract.”), 135 (stating that two questions common to all
members of the proposed class are “whether the SRR incorporates by reference the Privacy
Policy” and “whether the Privacy Policy incorporates by reference the Help Center pages”).

16
Even if the Court assumes that the Privacy Policy was incorporated into the SRR,
17

Plaintiffs’ argument fails because the Help Center pages were not incorporated into the Privacy

18
Policy. In the TAC, Plaintiffs cite several Help Center pages that, according to Plaintiffs,
19
contained promises not to track logged-out users. See TAC ¶¶ 62–67. Some Help Center pages
20
21

contain explicit promises to that effect—for instance, one page states: “When you log out of
Facebook, we remove the cookies that identify your particular account.” Id. ¶ 62, Ex. I. However,

22
none of those Help Center are referenced in the Privacy Policy. The Privacy Policy does not link
23
to them, mention them, or otherwise reference them directly.
24
Instead, Plaintiffs appear to argue that the individual Help Center pages are subparts of a
25

single “broader document.” Opp’n 5–6 (“a mainstay of Internet contract law teaches that

26
customers are often contractually bound to individual provisions . . . even when the hyperlink only
27
28

Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
6

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 7 of 9

1

links to the broader document”). This argument finds little factual support. The Help Center pages

2

exist independently at different URLs, as underscored by the fact that Plaintiffs attached Help

3

Center pages as separate exhibits to their TAC. See TAC ¶¶ 62–67 (citing, in order, TAC Exs. I, J,

4

M, L, MM, NN, OO, PP, R, S). No evidence suggests that a Facebook user who reads one Help

5

Center page has also read, or is even aware of, any of the others.

6

Plaintiffs also argue that the Help Center in its entirety is incorporated into the Privacy

7

Policy because the Privacy Policy links to some of its pages. Opp’n 6 (“Here, the TAC

8

demonstrates clearly how that the Help Center generally (not just specific pages) are incorporated

9

into the SRR. . . . [T]he Privacy Policy linked to the Help Center pages and directed users to them,
without exclusion.”) (emphasis added). Plaintiffs’ argument that the Privacy Policy “directed”

11
United States District Court
Northern District of California

10

users to Help Center pages “without exclusion” is at odds with TAC, which alleges that the

12

Privacy Policy linked to some Help Center pages, but not to the Help Center pages containing

13

Facebook’s promises to not track logged-out users. TAC ¶¶ 62–67. This relationship is too

14

attenuated to support Plaintiffs’ position that the entire Help Center is incorporated into the

15

Privacy Policy. See Woods, 2011 WL 3501403, at *3–4 (finding that pages within Google’s Help

16

Center were not incorporated by reference into another document, even when that document

17

contained direct hyperlinks to the Help Center pages at issue).

18

As such, the Court finds that the Help Center pages cited in the TAC were not incorporated

19

into the Privacy Policy because they were not “known or easily available to the contracting

20

parties.” Id. (quoting Troyk, 171 Cal. App. 4th at 1331).

21

B.

22

As Plaintiffs note, a claim for a violation of the duty of good faith and fair dealing must

Breach of the Duty of Good Faith and Fair Dealing

23

rest “upon the existence of some specific contractual obligation.” Opp’n 15 (quoting Avidity

24

Partners, LLC v. State, 221 Cal. App. 4th 1180, 1204 (2013)); see also Rosenfeld v. JPMorgan

25

Chase Bank, N.A., 732 F. Supp. 2d 952, 968 (N.D. Cal. 2010) (“[T]he implied covenant of good

26

faith and fair dealing ‘cannot impose substantive duties or limits on the contracting parties beyond

27
28

Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
7

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 8 of 9

1

those incorporated in the specific terms of their agreement.’ ”) (quoting Agosta v. Astor, 120 Cal.

2

App. 4th 596, 607 (2004)).

3

As discussed in the previous section, Plaintiffs have not identified contractual provisions

4

that prohibited Facebook from tracking logged-out users in the manner Plaintiffs allege. Plaintiffs’

5

claim for breach of the duty of good faith and fair dealing must therefore be dismissed.

6

C.

7

Plaintiffs’ second amended complaint alleged a class period that began on May 27, 2010,

8

and ended on September 26, 2011. Second Am. Compl. (“SAC”) ¶ 172, Dkt. No. 93. In the order

9

granting Facebook’s motion to dismiss Plaintiff’s SAC, this Court dismissed the majority of

Expanded Class Period

Plaintiffs’ claims without leave to amend. MTD Order 14. This Court granted leave to amend only

11
United States District Court
Northern District of California

10

as to Plaintiffs’ claims for breach of contract and breach of the duty of good faith and fair dealing,

12

and only “[b]ecause Plaintiffs [did] not identif[y] the specific contractual provisions they allege

13

were breached.” Id. at 13–14.

14

In their TAC, Plaintiffs allege a new class period that begins on April 22, 2010, and ends

15

on “a later date to be determined upon the completion of discovery.” TAC ¶ 132. This expanded

16

class definition exceeds the scope of leave to amend that the Court granted in its order dismissing

17

Plaintiffs’ SAC. Fed. R. Civ. P. 15(a)(2) provides that “a party may amend its pleading only with

18

the opposing party’s written consent or the court’s leave.” Plaintiffs did not obtain Facebook’s

19

consent or this Court’s leave to expand its class allegations. Accordingly, Plaintiffs’ expanded

20

class allegations are stricken.

21

D.

22

Courts “should freely give leave [to amend] when justice so requires.” Fed. R. Civ. P.

Leave to Amend

23

15(a)(2); In re Korean Air Lines Co., Ltd., 642 F.3d 685, 701 (9th Cir. 2011). Absent a showing of

24

prejudice, delay, bad faith, or futility, there is a strong presumption in favor of granting leave to

25

amend. Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1052 (9th Cir. 2003).

26

However, courts can dismiss without leave to amend in the event of a plaintiff’s “repeated

27
28

Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
8

Case 5:12-md-02314-EJD Document 174 Filed 11/17/17 Page 9 of 9

1

failure to cure deficiencies by amendments previously allowed.” Foman v. Davis, 371 U.S. 178,

2

182 (1962); see also Abagninin v. AMVAC Chem. Corp., 545 F.3d 733, 742 (9th Cir. 2008)

3

(“Leave to amend may also be denied for repeated failure to cure deficiencies by previous

4

amendment.”); Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 1007 (9th Cir. 2009), as

5

amended (Feb. 10, 2009) (“where the plaintiff has previously been granted leave to amend and has

6

subsequently failed to add the requisite particularity to its claims, ‘[t]he district court’s discretion

7

to deny leave to amend is particularly broad’ ”) (quoting In re Vantive Corp. Sec. Litig., 283 F.3d

8

1079, 1097–98 (9th Cir. 2002)).
Here, the Court previously allowed Plaintiffs to amend their claims for breach of contract

9

and breach of the duty of good faith and fair dealing. Since Plaintiffs’ amendments did not cure

11
United States District Court
Northern District of California

10

the defects the Court identified, Plaintiffs’ claims will be dismissed without leave to amend.

12

IV.

13

CONCLUSION
Facebook’s motion to dismiss is GRANTED. The Clerk shall close this file.

14
15
16
17
18

IT IS SO ORDERED.
Dated: November 17, 2017
______________________________________
EDWARD J. DAVILA
United States District Judge

19
20
21
22
23
24
25
26
27
28

Case No.: 5:12-md-02314-EJD
ORDER GRANTING DEFENDANT’S MOTION TO DISMISS
9